At a glance
- Company
- Department of Families, Fairness and Housing (Victoria)State government department, including child protection
- Size
- Enterprise (1,000+ employees) The regulator’s report says nearly 900 employees were almost 13% of the workforce.
- Where and when
- Australia (Victoria). 2023 – September 2024.
- Who produced the figures
- Official recordEverything on this page comes from the investigation report of the Office of the Victorian Information Commissioner, the state’s privacy regulator.
What happened
A child protection worker used ChatGPT to help draft a report for a children’s court. The report was about a young child whose parents had been charged with sexual offences. To get the draft, the worker typed in personal details about the child, the parents and the carer.
The department reported the incident to the state’s privacy regulator in December 2023. The regulator investigated and published its report in September 2024.
The numbers
- About 900 staff had opened the ChatGPT website between July and December 2023. That was almost 13% of the department’s workforce.
- 100 cases in the worker’s wider unit, over one year, showed signs that ChatGPT may have been used to draft child protection documents.
- Two breaches of the state’s privacy principles were found. One concerned keeping personal information accurate. The other concerned protecting it from unauthorised disclosure.
- 15 named AI tools had to be blocked for child protection staff, from November 2024 to November 2026. The list included ChatGPT, Claude, Gemini, Copilot and Grammarly.
- Four progress reports to the regulator were required, one every six months.
What the regulator found
- The report was wrong where it mattered. It described a child’s doll, which had been reported as used by the father for sexual purposes, as a sign that the parents provided “age-appropriate toys”. This played down the risk to the child. The regulator notes that the error did not change the court’s decision.
- The information left the department’s control. Once typed into ChatGPT, it was held by OpenAI, the company that runs the tool.
- General policies were not enough. The department pointed to its technology-use policy and its e-learning on privacy. The regulator found these “far from sufficient”. Staff could not be expected to work out from them how to use a new kind of tool.
- There was nothing specific. No rules on when the tools may be used. No training on how they work. No technical limit on access.
- Guidance alone did not settle it. After the incident the department issued guidance on generative AI. The regulator judged its content broadly fit for purpose. But the department had “almost no visibility” of how staff were using the tools. For child protection work, the regulator decided the risk was too great to manage by policy and guidance alone.
What the case shows
- Staff were already using the tools. About one in eight had opened ChatGPT before any rule existed.
- A general IT policy does not cover AI tools. The regulator expected rules and training written for these tools.
- For the most sensitive work, the answer was a block. A written rule was not accepted as enough where a mistake could harm a child.
- A person signed off a report with an obvious error in it. The tool wrote fluent text. Nobody checked it against the facts of the case.
What this says about the practices
Practices that were missing
- Decide what data may go into which AI tools The regulator found “no departmental rules in place about when and how these tools should or should not be used”, and no technical limits on access. Do first · Effort: low (days, one person)
- Train staff on the tools you actually chose The regulator found no evidence of any attempt to train staff on how generative AI tools work. General e-learning on privacy did not cover it. Do first · Effort: medium (weeks, a few people)
- Keep a person checking anything that goes to a customer or carries legal weight The report went to a court with a serious error in it. It described a doll that had been used for sexual purposes as an “age-appropriate” toy. Do first · Effort: medium (weeks, a few people)
- Know the rules that already apply to your AI use The regulator found two breaches of the state’s privacy principles: on keeping personal information accurate and on protecting it from unauthorised disclosure. Do first · Effort: low (days, one person)
What the company changed afterwards
Sources
- Office of the Victorian Information Commissioner (September 2024). Investigation into the use of ChatGPT by a Child Protection worker. Report, with the compliance notice and the department’s response. ovic.vic.gov.au